Security & trust

Your data. Your rules.

Brokerages, law firms and builders hold other people’s information. Here is exactly how Zekal handles it — and what we don’t claim yet.

THE SHORT VERSION
Every query is tenant-scoped. Nothing is sent without a person’s approval. Zekal never holds client money.
01In place
Tenant isolation

Every workspace is isolated at the database row. Every query and document search is tenant-scoped.

02In place
Record-level permissions

Matters and deals carry their own access lists. An agent sees their own deals; a clerk sees the matters they’re on.

03In place
Private buckets, expiring links

Documents live in private buckets. Each view uses a signed link that expires — nothing is public by URL.

04In place
No inbox access

No Gmail or inbox scopes. Zekal never reads your email.

05In place
Approve ≠ send

Approving a draft and executing it are separate, logged steps. Nothing goes out without a named person’s approval.

06In place
Immutable ledgers

Commission and money-tracking ledgers are append-only. A correction is a new line that points to the old one.

07In place
Audit trail of every agent run

Inputs, sources, draft, approver and result are recorded for every run, and kept with the record.

08In place
Answers show their sources

Every AI answer shows its tier and its sources. The legal pack has no AI answering — only cited search.

09In place
Backups

Regular database snapshots, checked by restoring them — not just by assuming they worked.

10In place
Never holds or routes client money

Deposits and trust funds stay in your accounts. Zekal tracks them and prepares files; it never holds or moves funds.

11In place
Gated production changes

Every production change goes through a staging gate and an automated review before a human merges it.

CERTIFICATIONS

Built for audits. Honest about where we are.

SOC 2Controls built for it · roadmap on request
ISO 27001Roadmap on request
Hosting regionAsk us — we’ll tell you exactly where

We don’t list a certification until an auditor has signed it. If your firm needs one for procurement, ask and we’ll share the plan and timeline.

QUESTIONS FROM FIRMS

What your compliance person will ask.

No. Every query and document search is scoped to your tenant, and matters and deals carry their own permissions on top of that.

Send us your security questionnaire.

Email us →